Obtaining temporary exclusive control of a printing device

ABSTRACT

Obtaining exclusive control of a printing device by deferring printing of print data in a print queue. To obtain control, the recipient performs a process which may include authentication of the recipient. Control may be obtained either before the recipient is authenticated or after a successful authentication process. After the recipient has obtained control, print data in the print queue is temporarily deferred from being printed. The recipient may then select a print job to print, including selecting a print job from among the print jobs deferred in the print queue, or selecting a file to print over a network, including the Internet or an intranet. Further, printing device resources utilized in printing data during the period of exclusive control may be tracked and correlated to the recipient who has control.

BACKGROUND OF THE INVENTION

[0001] 1. Field of the Invention

[0002] The present invention concerns obtaining temporary exclusivecontrol of printing devices. More particularly, the present inventionrelates to systems in which a recipient obtains control of a printer,either by being authenticated or in the absence of authentication. Afterthe recipient gains control, the printer appears “busy” for otherprinter requests and the recipient can select print jobs to print,including selecting print jobs over a network.

[0003] 2. Description of the Related Art

[0004] When printing print jobs to a printer, once the print jobs areprinted out, a recipient must go to the printer in order to retrieve thehardcopy printout. Often, upon arriving at the printer to retrieve hisprintout, the recipient discovers that his hardcopy printout is notthere. This may be because the recipient's print job is still pending inthe print queue behind other print jobs, or because the print job mayhave been accidentally or intentionally taken by someone else. A similarproblem arises with regard to facsimile transmissions. To address thisproblem, systems have been contemplated that defer printing a print jobor a facsimile transmission until the recipient is present at theprinter/facsimile.

[0005] One method of deferring printing of a facsimile transmission isknown with regard to a Canon Laser Class 7000/7500 facsimile machine.This facsimile machine defers printing a transmission received by thefacsimile machine by storing the transmission in a confidentialelectronic mailbox. The data is held in the mailbox until a personhaving the proper mailbox code arrives at the facsimile machine andenters the proper code to retrieve the data from the mailbox. Once theproper mailbox code has been entered, the transmission is printed by thefacsimile machine.

[0006] One method of deferring printing in printers is to requirerecipient authentication in order for the print job to be printed.Co-pending U.S. patent application Ser. No. 09/411,665 entitled“Authenticated Secure Printing”, filed Oct. 4, 1999, the contents ofwhich are hereby incorporated by reference into the subject applicationas if set forth herein in full, describes a method of requiringrecipient authentication in order to print secure documents. Briefly,the application describes a method where a user provides uniqueidentification information that is submitted with a print job to a printnode. Upon receiving the print job and unique identificationinformation, the print node encrypts the print job and stores it in asecure manner. In order to retrieve the secure print job from theprinter, a person having the proper authentication information providesthis information to the printer, whereby the printer processes andprints out the print job.

[0007] Another method of deferring printing of a document untilreceiving recipient authentication has been described in U.S. Pat. No.5,633,932 to Davis et al. According to the patent, a print job and aheader are sent to a print node in encrypted format. If the document isconsidered to be “sensitive”, then an indication that the document issensitive is placed in an electronic header identifying the document assensitive. Upon receiving the encrypted document and header, the printnode decrypts the header to determine if the document is sensitive; ifso, the document is stored until the print node receives authenticationfrom the recipient. Thereafter, the “sensitive” document is printed.

[0008] The foregoing methods provide a way to defer printing untilreceiving authentication of the recipient. However, none of thesemethods addresses the further control of printing operations after therecipient has been authenticated. More particularly, in each of theforegoing methods, after the recipient has been authenticated, all printjobs pending in the print queue before the recipient's print jobcontinue to print in the order they were received by the queue.Accordingly, the recipient has to wait until other print jobs pendingbefore his are printed before his print job is printed. Moreover, theauthenticated recipient is not able to select a print job to print fromamong those pending in the queue. Additionally, if the recipient submitsa print job after he has been authenticated, he may have to beauthenticated again in order for the newly submitted print jobs toprint. Further, the recipient is only able to print print jobs that havebeen received by the queue and is not able to manually access a remotestorage location and download a print job to print.

[0009] Additional concerns arise with regard to accurate accounting ofresources used in printing operations, such as the amount and type ofpaper used and the amount of ink used. In more detail, accurateaccounting of resources may be desired in order to bill a particulardepartment within an office or a particular person using the resources.Accounting is most commonly accomplished by software in a print serverthat tracks print jobs based on who submitted the print job. However,this accounting method does not accurately reflect the actual recipientwho is using the resources, but only identifies the sender or sendingdepartment. This becomes particularly apparent where one department suchas an accounting department, requests that another department such as anengineering department, send it a copy of a document. In this case, thesender (engineering) would be billed for resources whereas the recipient(accounting) is actually using the resources. As a result, the sender isbilled for resources that they are not using.

SUMMARY OF THE INVENTION

[0010] The present invention addresses the foregoing by providing asystem in which a recipient obtains exclusive control of a printer.While the recipient has exclusive control, print jobs that have been orthat are subsequently submitted to a print queue of the printer aredeferred. Meanwhile, the recipient accesses print data that he wants toprint and submits it to the printer for printing, whereby the print datais printed ahead of the print jobs in the print queue.

[0011] According to one aspect of the invention, the recipient obtainscontrol of the printer by being authenticated. Once the recipient isauthenticated, all authenticated print jobs that are intended for therecipient are printed, or alternatively, the recipient may select whichprint jobs to print. Print jobs intended for the recipient are those forwhich the recipient's authentication is required. Meanwhile, printing ofother print jobs are deferred.

[0012] Thus, in one aspect the invention allows exclusive control of aprinting device to be obtained by a recipient to print data thatrequires authentication of the recipient. According to the invention,the recipient is authenticated and then provided exclusive control ofthe printing device's print capabilities. After the recipient has beenauthenticated, print data not intended for the recipient is temporarilydeferred while print data intended for the recipient is printed during aperiod in which the recipient has exclusive control of the printingdevice's print capabilities.

[0013] As a result of the foregoing arrangement, once the recipient hasbeen authenticated, print jobs intended for the recipient are printedout before other print jobs. Meanwhile, all print jobs that are notintended for the recipient are deferred from being printed until therecipient's print jobs have completed printing and the recipientrelinquishes control of the printing device's print capabilities. Forinstance, once the recipient presents his authentication information andis authenticated, the printer appears busy to all other print jobs untilthe recipient's print jobs have completed printing and the recipient hasrelinquished control of the printer. Accordingly, the recipient canprint his print jobs before others without waiting for the others toprint first.

[0014] The invention is not limited to being utilized in conjunctionwith printers. Rather, the invention may also be utilized in conjunctionwith any image forming device including facsimiles and copiers.

[0015] Additionally, the invention provides for selection of which printjobs to print from among a list of print jobs. In this regard, therecipient can select those print jobs that he wants to print and deferprinting of the rest of his print jobs until a later time. For instance,if the recipient has several authenticated print jobs pending in thequeue and he needs to have one of the print jobs printed immediately(perhaps because he is in a rush to attend a meeting), he can select theone print job from a list and have it printed and can then return at alater time to retrieve the remainder of the authenticated print jobs.

[0016] Further, the invention provides for print by reference in whichprint data is stored in a remote location rather than in the queue, witha reference to the print data storage location being submitted to thequeue. This provides for printing data from any remote location, withoutunnecessarily filling the queue with large amounts of data.

[0017] The invention also provides for printing over the Internet or anintranet using an interface provided in the printing device. Once therecipient has obtained exclusive control of the printing device's printcapabilities, the recipient may access print data from a remote networklocation, including the Internet or intranet location, and can print itout on the printing device.

[0018] Further, the invention may track printing resources utilized byan authenticated recipient in printing data while the recipient hasexclusive control of the printing device's print capabilities andcorrelates the tracked resources to the recipient. Tracking theresources provides a way to account for the resources used by therecipient, such as the type and amount of paper used or the amount ofink used.

[0019] In another aspect, the invention is printing images on a printingdevice by obtaining control over printing operations of the printingdevice, and performing a process to access print data to print out animage by the printing device during a period of control over theprinting device. Obtaining control may include deferring of all printjobs submitted to a print queue for printing by the printing device,control over all communication interfaces of the printing device,control over network access to the printing device, or control overprint engine operations of the printing device. Further, obtainingcontrol may include authenticating a recipient, where the recipientobtains control either before or after the recipient is authenticated.The process to print out an image may include accessing print data overa network to be printed by the printing device, where the network may bethe Internet or an intranet, accessing at least one print job in a printqueue, or performing a copying operation or a facsimile operation.

[0020] In a further aspect, the invention is controlling printingoperations of a printing device by obtaining control over the printingoperations of the printing device, and maintaining control over theprinting operations until control is manually relinquished by arecipient who has obtained control. Obtaining control may includedeferring of all print jobs submitted to a print queue for printing bythe printing device, control over all communication interfaces of theprinting device, control over network access to the printing device, orcontrol over print engine operations of the printing device. Obtainingcontrol may also include authenticating a recipient, where the recipientobtains control either before or after the recipient is authenticated.The recipient may perform a process to print out an image by theprinting device while control is maintained over the printing device.The process may include accessing print data over a network to beprinted by the printing device, where the network may be the Internet oran intranet, accessing at least one print job in a print queue of theprinting device, or performing a copying operation or a facsimileoperation. Additionally, printing device resources utilized during theprinting process may be tracked and the tracked resources correlated toan authenticated recipient.

[0021] This brief summary has been provided so that the nature of theinvention may be understood quickly. A more complete understanding ofthe invention can be obtained by reference to the following detaileddescription of the preferred embodiments thereof in connection with theattached drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0022]FIG. 1 is a representative view of a networked computingenvironment in which the present invention may be implemented.

[0023]FIG. 2 is a detailed block diagram showing the internalarchitecture of the computer of FIG. 1.

[0024]FIG. 3 is a detailed block diagram of the internal architecture ofthe printer of FIG. 1.

[0025]FIG. 4 is a detailed block diagram of the internal architecture ofthe server of FIG. 1.

[0026]FIG. 5 depicts one system arrangement in which the invention maybe employed.

[0027]FIG. 6A is a flowchart depicting process steps for submitting aprint job for printing.

[0028]FIG. 6B is a flowchart depicting process steps for a print queueinsertion thread.

[0029]FIG. 6C is a flowchart depicting process steps for obtainingcontrol of a printing device after authentication is successfullycompleted.

[0030]FIG. 6D is a flowchart depicting process steps for processing of aprint job for printing after exclusive control is obtained.

[0031]FIG. 6E is a flowchart depicting process steps for a print queueextraction thread.

[0032]FIG. 6F is a flowchart depicting process steps for obtainingcontrol of a printing device before authentication is successfullycompleted.

[0033]FIG. 7 depicts an arrangement of print jobs in a print queue for afirst example.

[0034]FIG. 8 depicts an arrangement of print jobs in a print queue for asecond example.

[0035]FIG. 9 depicts an arrangement of print jobs in a print queue for athird example.

[0036]FIGS. 10 through 12 depict arrangements of print jobs in a printqueue for a fourth example.

[0037]FIG. 13 depicts an alternate system arrangement in which theinvention may be employed.

[0038]FIG. 14 depicts an alternate system arrangement in which theinvention may be employed.

[0039]FIG. 15 depicts a facsimile system arrangement in which theinvention may be employed.

[0040]FIG. 16 is a flowchart of process steps for obtaining exclusivecontrol in the absence of authentication.

[0041]FIG. 17A depicts a printer having a display and keypad that may beused in practicing the invention.

[0042]FIGS. 17B through 17D depict the display of FIG. 17A providingvarious printing options to the recipient.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0043]FIG. 1 provides an overall system view of a networked computingenvironment in which the present invention may be implemented. Althoughthe following description focuses primarily on the networked computingenvironment shown in FIG. 1, the present invention may be implemented invarious alternative systems. For example, the present invention may beimplemented in any arrangement including those shown in FIGS. 5 and 13to 15.

[0044] As shown in FIG. 1, the networked computing environment comprisesa network 100 which is connected to desktop computer 10, laptop computer20, server 40, digital copier 30 and printer 50. Network 100 ispreferably an Ethernet network medium consisting of a bus-type physicalarchitecture, although the invention can be utilized over other types ofnetworks, including the Internet or an intranet.

[0045] Desktop computer 10 may be an IBM PC-compatible computer having awindowing environment such as Microsoft Windows 95, Windows 98 orWindows NT, a Macintosh workstation, a UNIX workstation, a SunMicrosystems workstation, or virtually any workstation from which printjobs may be submitted for printing. For the purposes of brevity, only anIBM PC-compatible workstation will be described herein. As is typicalwith IBM PC-compatible computers, desktop computer 10 preferably has adisplay, keyboard, mouse, floppy drive and/or other type of storagemedium (not shown). Also attached to desktop computer 10 is smart cardinterface device 15 for interfacing with a smart card of a computeruser, such as smart card 16. Smart card 16 therefore provides amechanism whereby a computer user can authenticate the user's identityto desktop computer 10, printer 50 or digital copier 30. Although theuse of smart card interface device 15 and smart card 16 are describedherein, other mechanisms such as a hardware token and token reader mayalso be used.

[0046] Similar to desktop computer 10, laptop computer 20 also may beany type of laptop from which print jobs may be submitted for printing.However, for brevity, only an IBM PC-compatible computer having awindowing environment such as Microsoft Windows 95, Windows 98 orWindows NT will be discussed herein. Like desktop computer 10, laptopcomputer 20 also has a display, keyboard, mouse and floppy drive orother storage means (not shown). In addition, laptop computer 20 alsohas a smart card interface device 25 attached to it for interfacing tothe smart card of a computer user such as smart card 26.

[0047] Also attached to network 100 are digital copier 30 and printer 50which are capable of receiving image data over network 100 for printing.Digital copier 30 also has attached smart card interface device 35 forinterfacing with the smart card of a print job recipient, such as smartcard 36. Printer 50 likewise has smart card interface 55 for interfacingwith smart card 56.

[0048] Additionally, server 40 is connected to network 100. Server 40may be any type of computer that functions as a server such as a CompaqProsignia 1600 server. Also, server 40 may utilize any network operatingsystem such as Novell Netware, Windows NT, DOS, Windows 95/98 or UNIX.The present invention is not limited to any particular server type oroperating system and may be implemented with any server and operatingsystem in which print jobs are printed over a network. Server 40 has astorage device 41 which is preferably a large fixed disk for storingnumerous application document files, print data files or other datafiles. Additionally, server 40 preferably contains a print queue withinthe fixed disk for storing and managing print data processed throughserver 40. Server 40 can be utilized by other devices on network 100 asa file server and may also act as a gateway for other devices on network100 to another network such as the Internet.

[0049] Printer 50 may be any type of printing device from which imagesmay be printed. For example, printer 50 may be a laser or bubble-jetprinter which is capable of operating as both a printer and a facsimiledevice. Printer 50 may have a storage device 51 that is preferably alarge fixed disk. Storage device 51 may be utilized for storing printdata received by printer 50. However, as will become apparent from thediscussion below, a print queue and print data storage device ispreferably provided in server 40. Printer 50 also has an embeddedsmart-chip 57 which performs various functions related toencryption/decryption (if necessary) and authentication of a recipient.In addition, printer 50 is connected to smart card interface device 55which is capable of interfacing with a smart card of a print jobrecipient, such as smart card 56. In this manner, the printing of aprint job that requires authentication of the recipient may becontrolled through the use of smart card interface device 55 and smartcard 56, in combination with smart-chip 57 in printer 50.

[0050]FIG. 2 is a block diagram showing an overview of the internalarchitecture of desktop computer 10. In FIG. 2, desktop computer 10 isseen to include central processing unit (CPU) 210 such as a programmablemicroprocessor which is interfaced to computer bus 200. Also coupled tocomputer bus 200 are keyboard interface 220 for interfacing to akeyboard, mouse interface 230 for interfacing to a pointing device,floppy disk interface 240 for interfacing to a floppy disk, displayinterface 250 for interfacing to a display, network interface 260 forinterfacing to network 100, and smart card interface 265 for interfacingto smart card interface device 15.

[0051] Random access memory (RAM) 270 interfaces to computer bus 200 toprovide CPU 210 with access to memory storage, thereby acting as themain run-time memory for CPU 210. In particular, when executing storedprogram instruction sequences, CPU 210 loads those instruction sequencesfrom fixed disk 280 (or other memory media) into RAM 270 and executesthose stored program instruction sequences out of RAM 270. It shouldalso be noted that standard-disk swapping techniques available underwindowing operating systems allow segments of memory to be swapped toand from RAM 270 and fixed disk 280. Read-only memory (ROM) 290 storesinvariant instruction sequences, such as start-up instruction sequencesfor CPU 210 or basic input/output operation system (BIOS) sequences forthe operation of peripheral devices attached to computer 10.

[0052] Fixed disk 280 is one example of a computer-readable medium thatstores program instruction sequences executable by CPU 210 so as toconstitute operating system 281, printer driver 282, smart cardinterface driver 283, other drivers 284, word processing program 285,other programs 286, e-mail program 287 and other files 288. As mentionedabove, operating system 281 is preferably a windowing operating system,although other types of operating systems may be used with the presentinvention. Printer driver 282 is utilized to prepare image data forprinting on at least one image forming device, such as printer 50. Smartcard interface driver 283 is utilized to drive and control smart cardinterface 265 for interfacing with smart card interface device 15 so asto read and write to a smart card such as smart card 16. Other drivers284 include drivers for each of the remaining interfaces which arecoupled to computer bus 200.

[0053] Word processing program 285 is a typical word processor programfor creating documents and images, such as Microsoft Word, or CorelWordPerfect documents. Other programs 286 contains other programsnecessary to operate desktop computer 10 and to run desiredapplications. E-mail program 287 is a typical e-mail program that allowsdesktop computer 10 to receive and send e-mails over network 100. Otherfiles 288 include any of the files necessary for the operation ofdesktop computer 10 or files created and/or maintained by otherapplication programs on desktop computer 10. For example, Internetbrowser application programs, such as Microsoft Internet Explorer orNetscape Navigator, may be included in other files 288.

[0054]FIG. 3 is a block diagram showing an overview of the internalarchitecture of printer 50. In FIG. 3, printer 50 is seen to contain aprinter smart-chip 57 which may be utilized in conjunction withsmart-chip driver 358 for performing an authentication process of arecipient. Printer 50 also contains a central processing unit (CPU) 310such as a programmable microprocessor which is interfaced to printer bus300. Also coupled to printer bus 300 are control logic 320, which isutilized to control printer engine 325 of printer 50, I/O ports 330which is used to communicate with various input/output devices ofprinter 50 (not shown), smart card interface 365 which is utilized tointerface with smart card interface device 55, network interface 360which is utilized to interface printer 50 to network 100, and controldevice interface 356 which is utilized to interface with a device forobtaining control of the printer operations.

[0055] Control device interface 356 may interface with virtually anytype of mechanism that a user may activate to obtain control of theprinter. For instance, control device interface 356 may interface with abutton on a control panel of printer 50, whereby the user pushes thebutton to gain control over the printer. When the button is pressed, anindication of such is provided to print engine control logic 351,whereby the user gains control over the print engine operations. Ofcourse, other devices could be used to gain control over the printerincluding a user entering a username (identification) at a control panelof printer 50, or by an authentication device beginning or completing anauthentication process. As will be described in more detail below, theauthentication process may be any of a number of processes, includingbut not limited to entering a username and password, insertion of asmart card or hardware token into a reader, a wireless token (such as aspeedway pass), or turning of a key.

[0056] Control device interface 356 also interfaces with mechanisms forrelinquishing control of the printer. For example, a control panel ofprinter 50 may include one button for obtaining control, and a differentbutton for relinquishing control of the printer. In a similar manner asdescribed above, when a device for relinquishing control of the printeris activated, regardless of the type of device, control device interface356 supplies an indication that the relinquishing device has beenactivated to print engine control logic 351, whereby the userrelinquishes control over the print engine operations and normalprinting operations resume.

[0057] Also coupled to printer bus 300 are EEPROM 340, for containingnon-volatile program instructions, random access memory (RAM) 370,printer memory 51 and read-only memory (ROM) 390. RAM 370 interfaces toprinter bus 300 to provide CPU 310 with access to memory storage,thereby acting as the main run-time memory for CPU 310. In particular,when executing stored program instruction sequences, CPU 310 loads thoseinstruction sequences from printer memory 51 (or other memory media)into RAM 370 and executes those stored program instruction sequences outof RAM 370. ROM 390 stores invariant instruction sequences, such asstart-up instruction sequences for CPU 310 or BIOS sequences for theoperation of various peripheral devices of printer 50 (not shown).

[0058] Printer memory 51 is one example of a computer-readable mediumthat stores program instruction sequences executable by CPU 310 so as toconstitute printer engine logic 351, control logic driver 352, I/O portdrivers 353, smart card interface driver 354, other files 357, printersmart-chip driver 358, and e-mail program 359. Printer engine logic 351and control logic driver 352 are utilized to control and drive theprinter engine 325 of printer 50 so as to print an image according toimage data received by printer 50, preferably over network 100. I/O portdrivers 353 are utilized to drive the input and output devices (notshown) connected through I/O ports 330. Smart card interface driver 354is utilized to drive smart card interface 365 for interfacing to smartcard interface device 55, thereby enabling printer 50 to communicatewith a smart card such as smart card 56 during the process ofauthenticating a recipient.

[0059] Other files 357 contain other files and/or programs for theoperation of printer 50. Printer smart-chip driver 358 is utilized tointerface with printer smart-chip 57 for certain cryptographicoperations. E-mail program 359 is a typical e-mail program for enablingprinter 50 to receive e-mail messages from network 100. Such e-mailmessages may contain print job-related information, as discussed in moredetail below. Printer memory 51 also includes FTP/HTTP client 395 whichprovide the ability to retrieve files over the network through networkinterface 360. Also connected to printer bus 300 are display interface375 and keypad interface 385. As will be described below, printer 50 mayinclude a display and keypad that provides a recipient with an option toretrieve a print job from a remote storage location utilizing, forexample, FTP/HTTP client 395.

[0060]FIG. 4 is a block diagram showing an overview of the internalarchitecture of server 40. In FIG. 4, server 40 is seen to include acentral processing unit (CPU) 410 such as a programmable microprocessorwhich is interfaced to computer bus 400. Also coupled to computer bus400 is a network interface 460 for interfacing to network 100. Inaddition, random access memory (RAM) 470, fixed disk 41, and read-only(ROM) 490 are also coupled to computer bus 400. RAM 470 interfaces tocomputer bus 400 to provide CPU 410 with access to memory storage,thereby acting as the main run-time memory for CPU 410. In particular,when executing stored program instruction sequences, CPU 410 loads thoseinstruction sequences from fixed disk 41 (or other memory media) intoRAM 470 and executes those stored program instruction sequences out ofRAM 470. It should also be recognized that standard disk-swappingtechniques allow segments of memory to be swapped to and from RAM 470and fixed disk 41. ROM 490 stores invariant instruction sequences, suchas start-up instruction sequences for CPU 410 or basic input/outputoperating system (BIOS) sequences for the operation of peripheraldevices which may be attached to server 40 (not shown).

[0061] Fixed disk 41 is one example of a computer-readable medium thatstores program instruction sequences executable by CPU 410 so as toconstitute operating system 411, network interface driver 412,encryption/decryption logic 413, e-mail program 414, queue 415, FTP/HTTPclient 495, FTP/HTTP server 496 and other files 416. As mentioned above,operating system 411 can be an operating system such as DOS, Windows 95,Windows 98, Windows NT, UNIX, Novell Netware or other such operatingsystem. Network interface driver 412 is utilized to drive networkinterface 460 for interfacing server 40 to network 100. E-mail program414 is a typical e-mail program and enables server 40 to receive and/orsend e-mail messages over network 100. Queue 415 is utilized to storenumerous print jobs for output on one or more image forming devices,such as printer 50. Other files 416 contains other files or programsnecessary to operate server 40 and/or to provide additionalfunctionality to server 40. FTP/HTTP client 495 provides server 40 withthe ability to retrieve data files via FTP and HTTP protocols over thenetwork through network interface 460. Additionally, FTP/HTTP server 496of server 40 can be accessed by FTP/HTTP client 395 of printer 50 or anFTP/HTTP client in a workstation such as computer 10.

[0062] Obtaining temporary exclusive control of a printing device willnow be described in more detail. However, a brief description of what ismeant by obtaining temporary exclusive control, how exclusive controlcan be obtained, relinquishing exclusive control, what a user can dowhile he has exclusive control, and some of the terms used in thefollowing discussion will be presented first. Obtaining exclusivecontrol generally refers to blocking access to the printing device andgaining control of the print engine operations of the printing device.Blocking access means control over network access to the printingdevice, control over all other communication interfaces of the printingdevice and printing of printer status pages or other administrativeoperations. For instance, control over network access may be controlover access to print jobs, or, if the printing device is amulti-function device, control over incoming jobs such as incomingfacsimiles. Control over the communication interfaces may be controlover communication channels such as parallel and serial ports, USB(Universal Serial Bus) ports, infrared devices, RF devices, etc.

[0063] Additionally, control may be obtained either in conjunction withan authentication process or without regard to an authenticationprocess. In a case where control is obtained in conjunction with anauthentication process, control may be obtained either at the beginningof the authentication process or after the authentication process hascompleted. In the former case where control is obtained at the beginningof the authentication process, control is relinquished if theauthentication process fails. On the other hand, in the latter case,control is not obtained until a successful authentication process hasbeen completed.

[0064] There are numerous authentication processes that could beperformed, some of which are described in more detail below. Briefly,the authentication processes may include entering a username andpassword, insertion of a smart card or hardware token into a reader,reading of a wireless token (such as a speedway pass), turning of a key,or biometrics. Of course, the invention is not limited to any particularauthentication process and the invention may be employed with any typeof authentication process, including those listed above.

[0065] Control may also be obtained without an authentication process.For example, a user may enter a username on a keypad at the printer,thereby gaining control. This process does not necessarily perform anauthentication process, but rather merely identifies the user andprovides him with control over the printer upon entering his username.Additionally, the printer may be provided with a button for gainingcontrol. In this manner, a user who wants to gain control over theprinter merely presses the button and is provided control over theprinter. As can readily be seen, this type of device for gaining controlhas no correlation to the user and therefore any user could obtaincontrol in this manner. The invention is not limited to these methods ofgaining control and virtually any device that provides the ability togain control over the printer could be used.

[0066] After the user gains control of the printer, the printergenerally only returns to normal printing operations when the userrelinquishes control. Similar to the process of gaining control, thereare numerous ways in which a user could relinquish control and theinvention is not limited to any one particular way. Some examples ofways to relinquish control may be pressing a button on a control panelof the printer, a user activity timeout, completion of pending printoperations and a user activity timeout, removal of a smart card orhardware token from the reader, or removal of a smart card or hardwaretoken from the reader in conjunction with completion of pending printoperations, a user activity timeout and a token timeout. Additionally,an authentication/authorization failure could be utilized to relinquishcontrol.

[0067] While the user has exclusive control over the printer operations,there are various operations that can be performed. For instance, if theprinter is a multi-function device such as a printer/facsimile or aprinter/copier, the user can perform facsimile operations to send afacsimile or to print out a facsimile message stored in an electronicmailbox, or they may perform copying operations to produce photocopies.Additionally, the user may browse a network for files to print in theprinter. For instance, the user could browse a network for files storedin a file server or an e-mail server. Additionally, the user couldutilize a URL (Universal Resource Locator) to retrieve a file from theInternet or an intranet location and have it printed on the printer.Further, the user could access a listing of print jobs contained in aprint queue of the printer. The listing could be provided to display allprint jobs, only print jobs belonging to the user, or only authenticatedprint jobs belonging to the user (if the user is authenticated).Therefore, the user could select a print job from the queue to print. Ascan readily be seen, there are numerous operations that can be performedby the user once he has exclusive control over the printer. Theforegoing are merely some examples of operations that could be performedand the invention is not limited to these, but may include otheroperations as well.

[0068] Regarding some of the terms used in the following discussion, theterm “sender” refers to the person who submits a print job from a hostcomputer, or sending node, to be printed out by an image forming device.The “intended recipient” refers to the person holding the propercredentials with which he can authenticate himself at the image formingdevice. In some cases, the sender and the intended recipient may be onein the same. That is, the person who sends the print job may also holdthe proper credentials to authenticate himself at the image formingdevice. In other cases, the sender and the intended recipient may bedifferent individuals. For example, the sender may submit a print jobthat is to be retrieved by someone other than himself who holds theproper credentials to be authenticated at the image forming device.However, in the examples described below, the “intended recipient”refers to the person holding the proper credentials with which he canauthenticate himself at the image forming device, regardless of whosubmitted the print job.

[0069] The term “sending node” refers to an entity that submits printjobs to a printer. This may include, but is not limited to, a personalcomputer or an intermediate server other than a print server. A printjob may be submitted directly from a sending node to a print server orto a printer itself.

[0070] A “print queue” refers to a software and hardware mechanism forstoring print jobs. The mechanism may include, but is not limited to,buffers in RAM, RAM disks, hard disks, and flash disks. The print queuemay be located in any one of several locations, including a personalcomputer that submits the print jobs (sending node), a network printeritself, a stand alone print server, or a personal computer acting as aprint server. The print queue is a temporary storage location for printjobs before they are submitted to the printer for printing.

[0071] A “print server” refers to a software mechanism to receive printjobs and send them to a printer for printing. The print server may be astand alone print server such as a Novell P-server, may be containedwithin a network printer itself, or may be contained within anotherpersonal computer. In a case where the print server is contained withinanother personal computer, the print server in the personal computer mayaccept print jobs from another sending personal computer and then submitthem to a print server located within a networked printer.

[0072] A “printing device” refers to an entity that processes the printjobs and prints out an image onto a recording medium. Examples ofprinting devices include bubble-jet printers, laser printers, facsimilemachines, and network copier/printer machines. It should be noted thatthe present invention may be utilized in any image forming device,including but not limited to the foregoing image forming devices.

[0073] “Accounting software” refers to a computer program that performsaccounting tasks for network printing. Such a program may be provided ina centralized accounting server that retrieves usage information fromall printers in the network. The program could also reside on a printserver, within a personal computer acting as a print server, orvirtually any other device that is capable of collecting print job usageinformation from print jobs printed out by printers in the network.

[0074] In the following discussion, the term “normal print job” means aprint job that does not contain any special electronic headerinformation or other information identifying any particular recipientwith the print job and that does not require authentication of therecipient in order to be printed. Normal print jobs are generallyprocessed by the print server to be printed out in turn, i.e. afterother print jobs already received by the printer. They do not requirerecipient authentication in order to be printed and therefore are notheld off from being printed until a recipient presents the properauthentication information.

[0075] The term “authenticated print job” means a print job that canonly be printed out after the intended recipient has been authenticated.That is, an authenticated print job contains unique identificationinformation of the intended recipient and is held off from being printeduntil the recipient has been authenticated at the printer. Once therecipient has been authenticated, the authenticated print job isreleased for printing.

[0076]FIG. 5 depicts one system arrangement in which the presentinvention may be employed. The invention is not limited to beingemployed in the system of FIG. 5 and as will be described below, may beemployed in numerous other systems. As shown in FIG. 5, one or moresending nodes 510 such as computer 10, a print server 540 such as server40, and at least one printing device 550 such as printer 50, communicatevia a network 500. In this regard, network 500 may be any type ofnetwork, including a local area network (LAN), a wide area network(WAN), the Internet, an intranet or any other type of network. Ahard-wired network connection is not necessarily required and thepresent invention may be employed where the computer and printercommunicate via a wireless connection. Also attached to printer 550 issmart card interface device 555.

[0077] In the present system shown in FIG. 5, a print queue is externalto printer 550 and is preferably included within server 540. A casewhere the print queue is included within the printer itself rather thanbeing external to the printer will be described in more detail belowwith regard to FIG. 14.

[0078] As stated above, exclusive control can be obtained either inconjunction with authentication or without regard to authentication. Inthe following discussion, exclusive control in conjunction withauthentication will be discussed first and then a discussion ofexclusive control without regard to authentication will be provided.

[0079]FIGS. 6A, 6B, 6C and 6D are flowcharts depicting process steps forobtaining control of a printing device in conjunction withauthentication where control is obtained after a successfulauthentication process. Briefly, the process steps comprise print databeing submitted from a sending node to a print queue, determiningwhether the print job is an authenticated print job and if so, deferringprinting until the intended recipient is authenticated, authenticatingthe intended recipient, deferring printing of print jobs in the printqueue, the authenticated recipient selecting print jobs to be printedout, the authenticated recipient relinquishing control and the printingdevice resuming normal printing operations.

[0080] As shown in FIG. 6A, in step S600, in order to submit a printjob, a user activates a print driver at a sending node such as desktopcomputer 10 or laptop computer 20. For example, if the sender isutilizing a word processor application program, such as Microsoft Wordor Corel WordPerfect, and wants to print the document, he would normallyselect a print option within the application program, thereby activatinga print driver. The print driver usually permits the sender to selectprinting options, such as printing speed, print resolution, or number ofcopies. For the present invention, one option would be to select anauthenticated printing mode. In this regard, if the sender wants theprint job to only be printed out after the recipient has beenauthenticated at the printer, the sender would select this mode. Ofcourse the invention is not limited to selection of an authenticatedprint mode in a print driver and other processes for submittingauthenticated print jobs may be utilized instead. For instance, if theprint driver has the ability to automatically detect that a smart cardis inserted in the smart card reader, the print driver may automaticallyobtain the recipient's identification information from the smart cardand submit the print job as an authenticated print job, without the needfor a user to select an authenticated print mode in the print driver. Assuch, any method for submitting an authenticated print job could beutilized.

[0081] In FIG. 6A, if the print job is an authenticated print job, printdata is submitted along with user identification information (stepS601). The user identification information may be a distinguished namecontained in a digital certificate, a user/personal identificationnumber, biometric information, or any other information that uniquelyidentifies the intended recipient. The identification information linksthe print job to the intended recipient so that only the intendedrecipient is able to print the print job. More specifically,identification information (such as the intended recipient's first name,last name, country, locality (city), organization, organization unit, orother information that is unique to him) is linked to the print job. Theactual identification information linked to the print job isimplementation dependent. It could simply be a user ID number or perhapsan entire digital certificate. Of course, the sender would not havebiometric information of the recipient since such information requiresthe recipient to be present at the sending node and to supply suchinformation himself. However, after the sender submits the print jobutilizing the recipient's distinguished name or digital certificate, therecipient may be authenticated at the image forming device by abiometric device. Therefore, there may be a distinction between thetypes of devices utilized in linking the recipient's information to theprint job for submitting the authenticated print job and the types ofdevices utilized in authenticating the recipient.

[0082] The recipient's information may be obtained and linked to theprint job by various methods. For example, the sender could insert asmart card into a smart card reader located at the sending node, such assmart card reader 15 connected to computer 10 as seen in FIG. 1. Thesmart card contains the intended recipient's unique identificationinformation in digital form which is supplied to the computer throughsmart card interface 265. Alternatively, the information may be obtainedfrom a digital certificate via a Public Key Infrastructure, by e-mail orsome other device. In this case, the information could be downloaded tocomputer 10 over the Internet to be subsequently submitted with theprint job.

[0083] Further, biometric identifying information such as fingerprintsor retinal scans of the recipient could be utilized such that abiometric device at the printer could be used to authenticate therecipient. Therefore, any device that provides unique identificationinformation about the recipient to the sending node and subsequentlyperforms authentication of the recipient could be used.

[0084] Of course, authenticated print jobs are not the only type ofprint jobs that can be submitted by the sending node and the inventionis not limited to use with authenticated print jobs. The sender couldselect a normal print job mode from the printer driver wherein a normalprint job not requiring authentication of the recipient would besubmitted. Thus, in the present example, step S601 would be omitted.

[0085] Referring again to FIG. 6A, once the identification informationhas been provided in step S601, the authenticated print job is submittedfor printing from the sending node (step S602). In FIG. 5, theauthenticated print job is submitted to a print queue contained withinserver 540. However, as previously stated, the print job is not requiredto be submitted to a print queue in a server and may be submitted to aprint queue within the sending node itself, across a network to anintermediate server or to a print server contained within a printeritself.

[0086]FIG. 6B depicts process steps of a print queue insertion thread.In FIG. 6B, after the authenticated print job has been submitted by thesending node, the print queue insertion thread unblocks from waiting fora print job (step S603) in order to receive and store the print job(step S604). A determination is then made whether the received print jobis an authenticated print job (step S605). If the print job is not anauthenticated print job, control returns to step S603 and this threadwaits to receive another print job. Note that a separate print queueextraction thread is responsible for removing print jobs from the queueand sending them to the printer to be printed (depicted in FIG. 6E).

[0087] In most cases, upon receiving the print data from the printqueue, the printer buffers the data in memory and begins processing thedata to print out an image. However, in some printers, once the printdata is submitted from the queue to the printer, the printer maytemporarily store the data in a local disk within the printer ratherthan buffering the print data in memory. In these printers, oncesufficient data has been stored on the disk, the printer may beginbuffering the data from the local disk into the printer's memory andthen begin printing while the remainder of the data continues to bestored to the disk. Of course, the printer may also wait for the entireprint job to be stored in the local disk before data begins bufferingrather than beginning to buffer data once sufficient data has beenstored on the disk.

[0088] Returning to step S605, if the print job is an authenticatedprint job, then a determination is made whether or not the recipient hasbeen authenticated (step S606). This determination may comprise theprint queue performing a polling operation to poll the printer for therecipient's identification information. If the recipient has beenauthenticated, then the printer would respond to the queue with therecipient's identification information. If the recipient has not beenauthenticated, the printer may either provide a negative response or noresponse at all. If the recipient is not yet authenticated, then flowproceeds to step S607 where the print queue registers with the printerto receive a notification when the recipient is authenticated. Thus, theprint job is deferred from printing until the recipient holding theproper authentication information presents the authenticationinformation at the printer. The print data may be stored in the printqueue or in a print server.

[0089] There are various methods in which an authenticated print job maybe deferred from being printed until the recipient is authenticated. Onemethod is for the print queue to attempt to establish communication withthe printer in order to submit the print data to it for printing. Uponattempting to establish communication, the print queue may request therecipient's authentication information. If the printer has not receivedauthentication information from the recipient, i.e. the recipient hasnot yet been authenticated at the printer, then the print queue mayregister with the printer for the printer to notify it when therecipient has been authenticated. In the present example, since therecipient has not yet been authenticated, the printer fails to returnthe necessary authentication information and the print queue registerswith the printer and waits to send the print job data to the printerafter receiving notification (step S607).

[0090] Another method of deferring printing of an authenticated printjob may be accomplished by using a polling mechanism. Several networkprotocols utilize a request/response routine. In this regard, once thequeue receives an authenticated print job, the protocol requests therecipient's authentication information from the printer. If therecipient has not arrived at the printer and has not presented theauthentication information to the printer, then the printer returns anegative response or no response at all and the print job is deferredfrom being printed. Repeated requests are preformed over set timeintervals by the protocol, each receiving a negative response or noresponse until the recipient presents the authentication information tothe printer. Once the recipient has been authenticated, the protocolreceives the required information and then submits the print data to theprinter for printing.

[0091] The invention will now be described in more detail by way ofseveral examples. A first example will discuss a printer receiving bothnormal and authenticated print jobs where the recipient has not yet beenauthenticated. A second example will discuss a case where onlyauthenticated print jobs are in the queue, a recipient is authenticatedand opts to print all of his authenticated print jobs and promptlyrelinquishes control. A third example will discuss a case where bothnormal and authenticated print jobs are in the queue, a recipient isauthenticated and opts to select all of his authenticated print jobs andpromptly relinquishes control. A fourth example will discuss a casewhere both normal and authenticated print jobs are in the queue, arecipient is authenticated and maintains control. The fourth examplealso includes a discussion of additional print jobs being received bythe queue while the recipient maintains control. A fifth example willdiscuss an authenticated recipient selecting which print jobs to print,including print by reference print jobs, and selecting a print job froma network, such as via the Internet or an intranet.

[0092] In a first example, a print queue that contains both normal andauthenticated print jobs will be described with reference to FIGS. 7 and8. In this example, it is assumed that no authentication has beenprovided by any recipient to the printer. As shown in FIG. 7, the printqueue, such as queue 415 in server 40, contains six print jobs 601 to606. Print jobs 601, 602, 604 and 605 are normal print jobs and printjobs 603 and 606 are authenticated print jobs. Each print job in thequeue was received by the queue in ascending order.

[0093] The print queue extraction thread of FIG. 6E begins processing ofeach of the print jobs in the order in which they were received.Therefore, since print job 601 was received first, the print queueprocesses it first. As shown in FIG. 7, print job 601 is a normal printjob. Since no other print jobs are being printed by the printer and theprint job does not require recipient authentication, the print queueestablishes communication with the printer and submits the print data tothe printer where it is buffered and printed out (steps S652 and S653 asshown in FIG. 6E). While the printer is busy processing print job 601,print jobs 602 through 606 continue to be stored in the queue untiltheir turn to be processed arrives (the result of a NO determination instep S652).

[0094] Once all of the print data for print job 601 has been buffered,the print job is removed from the queue (step S654) and the print queuebegins processing the next print job in the queue, print job 602. Sinceprint job 602 is also a normal print job and does not require recipientauthentication to be printed, the print data is submitted by the queueto the printer where it begins buffering in the printer while print job601 completes printing. Once print job 601 completes printing andsufficient print data for print job 602 has been buffered, the printerbegins to print print job 602 (step S653).

[0095] Once all of the print data for print job 602 has been buffered,the print job is removed from the queue (step S654) and the print queueattempts to submit the next print job to the printer. In the presentexample, print jobs 603 through 606 are pending in the queue andtherefore the print queue attempts to submit print job 603. However,since print job 603 is an authenticated print job, the print queueextraction thread gets the next print job in the queue (step S650).

[0096] Therefore, since print job 604 is a normal print job, like printjobs 601 and 602, print job 604 is processed and printed out (steps S652and S653). Likewise, normal print job 605 is processed and printed afterprint job 604. Then, following processing of print job 605, the printqueue attempts to submit authenticated print job 606. However, likeprint job 603, print job 606 is not printed and remains in the printqueue after print job 603 (step S651). Therefore, after print jobs 601,602, 604 and 605 have been printed, the print queue appears as shown inFIG. 8.

[0097] A second example will now be discussed with regard to FIGS. 6C,6D and 8, wherein an authenticated recipient retrieves authenticatedprint jobs 603 and 606 remaining in the queue as shown in FIG. 8. Inthis example it is assumed that once the recipient selects an option toprint all of his authenticated print jobs, he promptly relinquishescontrol of the printer.

[0098] As stated above, there are several ways in which an authenticatedrecipient can relinquish control over the printer after he has beenauthenticated. One way would be for the recipient to merely push arelease button on the printer after he has been notified that he hasbeen successfully authenticated and has selected a printing option (suchas print all authenticated print jobs or select a print job to print).Upon pushing the button, the printer would notify the print queue thatthe recipient has relinquished control and that it is now available foraccepting print jobs, depending upon the printer's buffer spaceavailability of course. However, even where the recipient has beenauthenticated and presses a button to release control over the printer,if the user opts to print all of his authenticated print jobs pending inthe queue, the authenticated print jobs continue to be processed and areprinted out ahead of other print jobs. This provides the recipient theability to gain control over the printer just long enough to have hisauthenticated print jobs printed out ahead of other print jobs withoutthe recipient having to wait at the printer until all of his print jobshave been printed before he relinquishes control. Therefore, therecipient can be authenticated and promptly relinquish control so thathis print jobs will be printed, but he does not have to wait at theprinter and can leave the printer and return at a later time to retrievehis hard copy printouts if he wants to.

[0099] Other methods for relinquishing control may include the recipiententering a code on a keypad or removing his smart card from the smartcard reader. With the latter method, the recipient presents his smartcard to the smart card reader, whereby he is authenticated and gainscontrol over the printer. As long as the recipient's smart card remainsin the smart card reader, he remains authenticated and maintains controlover the printer. Once the recipient removes his smart card from thereader, he is no longer authenticated and relinquishes control over theprinter. As stated above, the invention is not limited to any particularmethod of relinquishing control and the foregoing are merely examples ofsome of the methods that may be employed.

[0100] Returning to the present example, it should be noted that thepresent example relates to a case where only authenticated print jobsare pending in the queue at the time the recipient is authenticated andthat no additional print jobs are received by the queue after therecipient is authenticated. A case where print jobs other thanauthenticated print jobs are pending in the queue when the recipient isauthenticated or where print jobs are received by the queue after therecipient has been authenticated will be discussed in more detail below.Additionally, in the present example, it is assumed that the recipientis authenticated using a smart card. Of course, as stated above anymethod of authentication could be employed and the invention is notlimited to use with smart cards. However, for the sake of brevity, onlythe use of smart cards will be discussed in detail.

[0101] Referring to FIG. 6C, in order to have print jobs 603 and 606printed out, the recipient holding the proper authentication(identification) information presents this information to the printer instep S609. For the present example, the recipient presents smart card 56to smart card reader 55 attached to printer 50. Once the recipientpresents his smart card to the smart card reader, the printer processesthe information through smart card interface 365 and smart cardinterface driver 354 to control logic 320. The printer then performs averification procedure to validate the integrity and authenticity of theunique identification information (step S610). If the integrity andauthenticity check fails (step S611), the user is notified of such instep S616. If the integrity and authenticity check is successful (stepS611), an authentication process is performed in an attempt toauthenticate the recipient (step S612). This may comprise printer 50performing a “challenge/response” mechanism, or other process tovalidate the identity of the recipient (in this case, the smart cardholder).

[0102] In step S613, a determination is made whether the attempt toauthenticate the recipient is successful. If the recipient isauthenticated, flow proceeds to step S614. If the attempt toauthenticate has failed, then the recipient is notified of theauthentication failure (step S616). The notification may be provided viaa visual display having an error message, an alarm on the printer orsome other device to indicate that the authentication process hasfailed.

[0103] After authentication, an optional check to determine whether therecipient is authorized to use the device may be performed (step S614).This authorization verification may be performed through a mechanismthat includes but is not limited to directory queries and access controllist lookups. If the recipient is not authorized to use the device, thenhe is provided with an authorization failure (step S616). If therecipient is authenticated and authorized, he may receive a notificationto this effect.

[0104] Once the recipient has been authenticated and optionallyauthorized (if an authorization check is provided for), the recipientgains exclusive control of the device in the present example and allprint jobs pending in the queue are deferred and prevented from beingprinted (step S617). Additionally, in step S617, if the print queue hasregistered to receive a notification from the printer, it is notifiedthat the recipient has been authenticated. One way print jobs may bedeferred is by the printer providing an indication to the queue that itis “busy” or that the printer's buffer is full. Recall that in order forprint data to be submitted by the queue to the printer, the queuegenerally attempts to establish communication with the printer anddetermines whether the printer is available for accepting print data.Therefore, if the printer appears busy, then it is unavailable foraccepting print data, thereby preventing the print jobs in the queuefrom being sent to the printer. In the present example, after therecipient has been authenticated, the printer appears busy for all printjobs in the queue and continues to appear busy until the recipientrelinquishes control of the printer. It should be noted that the presentinvention is not limited to a busy or buffer full indication and anyother mechanism for preventing the print jobs from being buffered andprinted may also be utilized.

[0105] Upon receiving notification that the recipient has beenauthenticated (step S617), the queue determines whether anyauthenticated print jobs are pending in the queue for the authenticatedrecipient (step S618). If no authenticated print jobs are pending in thequeue for the authenticated recipient, the recipient is notified of suchin step S619. If print jobs are pending in the queue for theauthenticated recipient, then flow proceeds to step S622 in FIG. 6D. Inthe present example, print jobs 603 and 606 are pending in the queue.

[0106] As seen in FIG. 6D, in step S622 a determination is made whetherthe recipient has opted to select a print job to print. In this regardthe recipient may select one or more print jobs from a list of printjobs pending in the queue. Alternatively, the recipient may select aprint job from a remote storage location. A more detailed discussion ofrecipient selection of a print job is provided below with regard toFIGS. 17A through 17D. If the recipient opts for user selection, thenflow proceeds to steps S624 and S625 where the recipient selects a printjob and the selected print job is released to be printed. If therecipient does not opt for user selection, but rather opts to print allof his authenticated print jobs pending in the queue, then flow proceedsto step S623 where the next authenticated print job pending in the queuefor the authenticated recipient is released to be printed. In thepresent example, once the user opts to print all of his authenticatedprint jobs, he relinquishes control of the printer by removing his smartcard from the reader.

[0107] The next authenticated print job (print job 603 in the presentexample) in the queue is processed through steps S626 to S630, with flowthen returning to step S620 of FIG. 6C. In the preferred embodiment, therecipient is required to maintain control over the printing device inorder to print all of his authenticated print jobs. That is, eachauthenticated print job is processed one at a time from step S618 tostep S630 and back to step S620. As such, upon completion of processingprint job 603, the printer begins a new process to process the nextauthenticated print job (print job 606). In the process for print job606, the print queue again requests the recipient's authenticationinformation from the printer. If the recipient has relinquished controlin step S620, the printer will provide a negative response or noresponse at all. Therefore, in the preferred embodiment, once therecipient relinquishes control (here, by removing his smart card), anyauthenticated print jobs pending in the queue for which the print queuehas not yet requested the recipient's identification information willremain in the queue and will not be printed until the recipient isauthenticated again. Therefore, once the recipient has relinquishedcontrol and print job 606 has not yet begun to be processed, print job606 remains in the print queue.

[0108] Alternatively, once the recipient has been authenticated and optsto print all of his authenticated print jobs pending in the queue, theprint queue may utilize the recipient's identification information torelease and process all authenticated print jobs intended for therecipient (print jobs 603 and 606) in the queue in step S623, before adetermination is made in step S620 whether the recipient hasrelinquished control. In this case, both print jobs 603 and 606 would beprocessed and the print queue would then be empty.

[0109] Returning to FIG. 6D, when a print job has been released forprinting in either step S625 or step S623, a determination is madewhether the print job is a print by reference print job (step S626). Inthe present invention, a print by reference print job is one in whichthe print data is not stored in the print queue, but rather is stored ina remote storage location with the print job in the queue containing areference to the remote storage location. If the print job is a print byreference, then the queue retrieves the print data from the remotestorage location in step S627. If the print job is not a print byreference, then flow proceeds to step S628.

[0110] In step S628 the printing process commences and in step S629,printing resources utilized during the printing operations are tracked.For example, resources such as the number and type of paper or theamount and type of ink utilized during the printing operations may betracked. The tracked resources are then correlated with theauthenticated recipient's identification information and submitted to anaccounting device that utilizes the tracking information (step S630).Such an accounting device may be a print server or other device thatemploys an accounting program. It should be noted that in some casesresource tracking may not be desired and therefore steps S629 and S630may be omitted.

[0111] After printing the authenticated print jobs, a determination ismade whether the recipient has relinquished control of the printer (stepS620 in FIG. 6C). In the present example, recall that the recipient hasrelinquished control promptly after being authenticated and selecting anoption to print all of his authenticated print jobs. That is, hepromptly removes his smart card from the smart card reader, therebyrelinquishing control over the printer's print capabilities. In thepreferred embodiment, print job 603 is processed and after the recipienthas relinquished control, the printer provides a negative response forprinting print job 606 and it remains in the queue with the printerreturning to normal printing operation where it releases all deferred(non-authenticated) print jobs pending in the queue (step S621) (i.e.the printer no longer provides a busy indication).

[0112] Of course, with regard to the alternate embodiment, when therecipient relinquishes control of the printer before print job 606 isprocessed, the determination in step S620 is not performed until afterprint job 606 has been processed and therefore, the printer does notreturn to normal printing operations until all authenticated print jobshave completed printing.

[0113] A third example will now be described with regard to FIGS. 6C, 6Dand 9. In this example, print jobs 1001 to 1005 are pending in the queueat the time the recipient is authenticated, at least one of which is anauthenticated print job requiring authentication of the recipient to beprinted. Like the second example, in the present example the recipientpresents the proper authentication information using a smart card deviceand promptly removes his smart card from the smart card reader. Also, inthe present example the recipient does not opt for user selection ofprint jobs and none of the print jobs are print by reference.

[0114] In respect of the present example, the print jobs pending in theprint queue at the time just prior to step S609 are as shown in FIG. 9.Therefore, just prior to the recipient presenting his smart card to thesmart card reader, print jobs 1001 through 1005 are pending in thequeue, with print jobs 1004 and 1005 being the authenticated print jobspending for the authenticated recipient.

[0115] Referring again to FIG. 6C, once the recipient has beenauthenticated and authorized (if provided for), the print queue isnotified that the recipient has been authenticated and all print jobspending in the queue are deferred in step S617 as described above.Again, deferring the print jobs may be accomplished by the printermerely providing an indication to the queue that it is busy or that thebuffer is full, thereby preventing the print jobs in the queue frombeing submitted to the printer.

[0116] Once all of the print jobs pending in the queue have beendeferred, the queue determines whether any authenticated print jobs arepending for the recipient (step S618). The determination may be made bymatching the authenticated recipient's unique identification informationto the print jobs pending in the queue. If a match is found, then flowproceeds to step S622 of FIG. 6D. If no matching print jobs are found,then the recipient is notified of such in step S619. In the presentexample print jobs 1004 and 1005 are authenticated print jobs matchingthe authenticated recipient. Accordingly, flow proceeds to step S622where the recipient opts for printing all of his authenticated printjobs. Therefore, flow proceeds to step S623 where print job 1004 isreleased to print and processed through steps S626 to S630.

[0117] Then, flow returns to step S620 of FIG. 6C to determine whetherthe recipient has relinquished control. Recall that in the presentexample, the recipient removes his smart card from the reader promptlyafter opting to print all of his authenticated print jobs. Accordingly,in step S620 it is determined that the recipient has relinquishedcontrol and print job 1005 is not released and printed. Therefore, onceprint job 1004 has printed, the remaining non-authenticated (normal)print jobs in the queue are then released and processed accordingly(step S621).

[0118] A fourth example will now be described with regard to FIGS. 6C,6D and 10 through 12. In this example, the print queue of FIG. 10 isinitially the same as that shown in FIG. 9. However, unlike the previousexamples, the recipient does not promptly relinquish control over theprinter once he is authenticated, but rather maintains control over theprinter. Also, in the present example, after the recipient has beenauthenticated, additional print jobs are received by the queue, therecipient does not opt for user selection, and none of the print jobsare print by reference.

[0119] In the present example, steps S609 through S623 are the same asdescribed above. To summarize these steps, once the recipient isauthenticated, all print jobs in the print queue are deferred andauthenticated print job 1004 is processed and released to print. Flowthen returns to step S620 where it is determined that the recipient hasnot relinquished control and therefore flow returns to step S623 toprocess and release print job 1005. However, unlike the third example,the print jobs remaining in the queue after all authenticated print jobshave been printed (here, print jobs 1001, 1002 and 1003) are notreleased, but rather remain deferred in the print queue. This is becausethe recipient has not relinquished control of the printer in step S620.Recall that one way for a recipient to maintain control over the printeris to merely leave his smart card in the reader, thus continuing todefer printing of all print jobs remaining in the queue that are notauthenticated print jobs for the recipient.

[0120] Accordingly, as shown in FIG. 6C, in step S620 a determination ismade whether or not the recipient has relinquished control. Since therecipient has not relinquished control, the print jobs remain deferredwith flow returning to step S618 to determine if any additionalauthenticated print jobs are pending in the queue. That is, adetermination is made whether any new authenticated print jobs have beenreceived by the queue.

[0121] Assuming that the recipient has not yet relinquished control,i.e. has not removed his smart card from the smart card reader, thepresent example will now be expanded to include receipt of additionalprint jobs while the recipient maintains control over the printer. Asshown in FIG. 11, print jobs 1001, 1002 and 1003 remain deferred in thequeue. Additionally, normal print job 1006 and authenticated print job1007 are received by the queue while the recipient maintains controlover the printer. When additional print jobs are received, theprocessing of these print jobs begins at step S603 of FIG. 6B. Once theprint job is added to the queue (step S604), flow returns to step S603,unless the print job is an authenticated print job. When the print queueinsertion thread determines that the print job received is anauthenticated print job (step S605) and that the intended recipient isauthenticated at the time the job arrives (step S606), it then waits foranother print job (step S603). Therefore, print job 1006 in this exampleis deferred. However, since the recipient has already beenauthenticated, the operations as defined in steps S618 to S621 of FIG.6C determine that an authenticated print job intended for theauthenticated recipient is available and thus print job 1007 isprocessed and released to be printed similar to print jobs 1004 and1005. As a result, any authenticated print jobs intended for therecipient that are received by the queue during a period in which therecipient maintains control over the printer's print capabilities areprinted out, while normal print jobs are deferred from being printed.Again, once the recipient relinquishes control, the printer returns tonormal printing operation and print jobs 1001, 1002, 1003 and 1006 arereleased and printed.

[0122] In a fifth example, FIG. 12 shows a queue after print jobs 1004,1005 and 1007 have been printed with print jobs 1001, 1002, 1003, and1006 remaining deferred and authenticated print job 1008 is received bythe queue. Authenticated print job 1008 requires authentication of adifferent authenticated recipient. That is, the recipient who has beenauthenticated at the printer is not the intended recipient for theauthenticated print job 1008. Again, steps S603 to S605 of FIG. 6B arethe same as described above. However, in step S606 a determination ismade whether the intended recipient is authenticated. Since print job1008 is an authenticated print job, but is for a different authenticatedrecipient, it is not released and printed. Rather, the queue registerswith the printer to receive notification upon authentication of theintended recipient (step S607) and then returns to step S603. This jobis not released and printed until the print queue is notified that therecipient holding the proper identification information for print job1008 has been authenticated at the printer.

[0123] The foregoing examples describe the use of a smart card to gaincontrol over the printer's print capabilities. However, as previouslymentioned, another device such as a keypad or biometric device couldalso be utilized to accomplish the same function. The foregoing examplesalso describe the invention in an arrangement where a print queue iscontained within a server and all data is stored in the print server.However, as will be described below, the present invention may beemployed in various other arrangements.

[0124] One alternative arrangement in which the invention may beemployed is depicted in FIG. 13. As seen in FIG. 13, the network mayinclude data store 1301 as well as the aforementioned print server. Thedata store may be an additional storage medium, such as a hard diskattached to the print server, a separate computer having a hard disk forstoring print data, or some other type of storage medium. With thisarrangement, print data submitted from the sending node may be stored inthe data store and a reference to the stored print data file name andlocation submitted to the print queue. Alternatively, rather than printdata being submitted from a sending node to the data store as part of aprint job submission, the print data may reside in the data store priorto the print job being submitted from the sending node. In this case,the print job submitted to the queue would merely provide a reference tothe print data storage location.

[0125] The operation of this arrangement works similarly to the aboveexamples. In one difference, once the print job is released to print(step S623), a determination is made whether the print job is a print byreference print job in step S626. Since the print job is a print byreference, the print queue utilizes the print data storage referencelocation to retrieve the stored print data (step S627) and then submitsthe retrieved print data to the printer.

[0126] The network depicted in FIG. 13 may be the Internet. Once theprint job has been released to print, the print queue retrieves theprint data over the Internet from the data store and processes it to beprinted. Accordingly, in order for the print queue to retrieve printdata over the Internet, the print server is provided with the ability toaccess the Internet through FTP/HTTP client 395 or 495 shown in FIGS. 3and 4.

[0127] The invention is also not limited to an arrangement in which thequeue is contained within a print server. Rather, the queue may becontained within the printer itself, or within a personal computer orother device. Such an arrangement may provide a system similar to thatshown in FIG. 14. In FIG. 14, sending nodes 1410 communicate withprinter 1450 over network 1400. Attached to printer 1450 is smart cardreader 1455. The queue may be provided in the printer in a storage disksuch as queue 315 in printer memory 51 shown in FIG. 3. Alternatively,the queue may be provided in fixed disk 280 of computer 10. Theoperation of this arrangement would be similar to that described abovewith one difference being that the printer does not need to communicateover a network to an external queue in a print server. Rather, the hostcomputer and the printer themselves communicate to provide thefunctionality of the invention.

[0128] Moreover, the present invention is not limited to an arrangementof a computer (sending node) and printer communicating over a network.In this regard, FIG. 15 depicts an arrangement where the presentinvention is employed in a facsimile model. To employ the presentinvention in a facsimile model, a facsimile machine capable of providingthe recipient's unique identification information at the sendingfacsimile is utilized. Therefore, the sending facsimile may also utilizethe smart card interface as described above. At the receiving end, thefacsimile machine stores and defers printing of facsimile transmissionssimilar to the printer model described above. Therefore, the presentinvention of controlling printout operations of facsimile transmissionsstored in a queue is performed in the same manner as the printer modeldescribed above.

[0129] In a further aspect of the invention, rather than opting to printall authenticated print jobs, a mechanism for the recipient toselectively choose which print jobs to print may be provided for. Thisoption refers to user selection steps S622, S624 and S625 of FIG. 6D.One way to accomplish the foregoing may be to provide a display at theprinter, such as display 1700 of printer 1750 shown in FIG. 17A. Theprinter may also be provided with a keypad 1720 to allow the recipientto choose from among various options shown on the display.Alternatively, the display itself may be a touch panel display, therebyeliminating the need for a keypad.

[0130]FIG. 17B depicts one example of display screen 1700. As seen inFIG. 17B, once the recipient is authenticated, the display may providean indication to the recipient that he has been authenticated (1701) andalso provide him with the option to either select a print job to print(1702) or to print all print jobs pending in the queue for him (1703).In this aspect of the invention, the recipient is authenticated in thesame manner as described above. However, once the recipient isauthenticated and opts to select a print job to print, all print jobs inthe queue are deferred until the recipient selects which print jobs toprint. If the recipient selects option 1703 (opting to print all of hisauthenticated print jobs), then as described above, all authenticatedprint jobs pending in the queue, as well as those received by the queuewhile the recipient maintains control over the printer, are processedand printed out in the same manner as described above.

[0131] However, in the case where the recipient selects option 1702(select a print job to print corresponding to step S624), thenadditional options may be provided to the recipient on display 1700. Asshown in FIG. 17C, one further option is option 1704 to select a printjob from among those pending in the queue. In a case where this optionis selected, a listing of the print jobs pending in the queue isprovided on the display. The listing may include all print jobs that arematched with the recipient's identification information, or may list allprint jobs pending in the queue, including normal and authenticatedprint jobs but preferably not jobs intended for other recipients. Fromthis listing, the recipient can select one or more print jobs to print,either one of his normal print jobs or one of his authenticated printjobs. These print jobs are then released and processed in step S625. Aslong as the recipient maintains control over the printer, all print jobsin the queue are deferred until they are either released by therecipient selecting them from the display or the recipient relinquishescontrol of the printer.

[0132] As a result of the foregoing, if the queue contains fiveauthenticated print jobs all belonging to the recipient and numbered 1through 5 respectively, the recipient can choose to only printauthenticated print job 5 without printing authenticated print jobs 1 to4. He can then return at a later time and print any of print jobs 1 to4.

[0133] Another option shown in FIG. 17C is for the recipient to select aprint job from a network (1705), i.e. a location on a network other thanthe print queue. The network may be any type of network, including a WAN(Wide Area Network), a LAN (Local Area Network), an intranet, theInternet, a USB, 1394, home network, etc. Print data may be browsed andretrieved from the Internet, an intranet, or e-mail using a methodsimilar to that disclosed in co-pending U.S. application Ser. No.09/465,835, entitled “System For Retrieving And Printing NetworkDocuments,” filed Dec. 17, 1999, the contents of which are incorporatedby reference as set forth in full herein. In this embodiment however,the front panel interface of the device serves as the web browserdescribed in application Ser. No. 09/465,835. Upon selecting option1705, additional options as shown in FIG. 17D may be displayed.

[0134] It should be noted however, that in the current aspect of theinvention, i.e. printing data over the Internet or an intranet, theprint jobs downloaded are not necessarily authenticated print jobs inthe sense that authenticated print jobs would ordinarily be providedwith the recipient's authentication information. In more detail, in eachof the previous aspects print jobs were submitted from a sending node toa print queue over a network. As such, the recipient's identificationinformation was provided at the sending node in order for the print jobsto be identified as authenticated print jobs. In order to print thoseprint jobs, the recipient had to be authenticated at the printer andthen the authenticated print jobs were printed out.

[0135] In the present aspect however, the print job is not beingsubmitted by a sending node but rather is being requested from theprinter itself after the recipient has been authenticated and while hemaintains control of the printer. Therefore, the printer already knowswho the authenticated recipient is and that the recipient has control ofthe printer. Therefore, all print jobs printed over the Internet or anintranet are released and printed once they are downloaded because therecipient has already been authenticated and has control of the printer.

[0136] Another aspect of the invention concerns accurate accounting ofresources used in printing operations, such as the amount and type ofpaper used and the amount of ink used. In more detail, accurateaccounting of resources may be desired in order to bill a particulardepartment within an office or a particular person using the resources.Accounting is most commonly accomplished by software in a print serverthat tracks print jobs based on who submitted the print job. However,this accounting method does not accurately reflect the actual recipientwho is using the resources, but only identifies the sender or sendingdepartment.

[0137] Therefore, the present invention provides for utilization of anaccounting application program in conjunction with the authenticatedrecipient's unique identification information. In the present aspect,once the recipient has been authenticated, the printer resourcesutilized during the printing operations are tracked by the printer (stepS629). The printer then correlates the tracked resources with theauthenticated recipient's identification information (step S630). Thetracked data may then be submitted by the printer to a device thatcontains an accounting application program, such as print server 40.Alternatively, the printer may register with the print server or anotherdevice utilizing the accounting program and the print server or devicemay access the printer periodically to collect the accountinginformation. An accounting application program in the print server thenutilizes this information to match resources utilized during allprinting operations while the recipient has control of the printer andto bill the department that the recipient belongs to. In this manner,the accounting application can track the resources to the personactually utilizing them, rather than matching them to a sender who mayor may not be utilizing them.

[0138] The foregoing provided a description of obtaining exclusivecontrol in conjunction with authentication where exclusive control wasnot obtained until the recipient had been successfully authenticated.The following describes a process for obtaining exclusive control inconjunction with authentication, but with exclusive control beinggranted before the recipient is successfully authenticated.

[0139] Generally, the process is similar to that described above withthe regard to FIGS. 6A to 6D. However, some changes in the process stepsare required and therefore FIG. 6F is substituted for FIG. 6C.Accordingly, the process steps depicted in FIGS. 6A and 6B apply equallyto both a case where exclusive control is obtained only after therecipient has been successfully authenticated and where exclusivecontrol is obtained before the recipient has been successfullyauthenticated. As such, a description of FIGS. 6A and 6B will not berepeated here, but rather, only FIG. 6F will be discussed.

[0140] As seen in FIG. 6F, step S609 is different from step S609 of FIG.6C. In FIG. 6C, the recipient merely presented his identificationinformation and then the printer processed the information to performauthentication in steps S610 to S615. After the recipient wassuccessfully authenticated in FIG. 6C, then in step S617 all print jobsin the print queue were deferred. Therefore, exclusive control in FIG.6C was not obtained until step S617. In FIG. 6F, however, when therecipient presents his identification information to begin theauthentication process (step S609), the printer simultaneously providesan indication to the queue that it is busy, thereby deferring all printjobs pending in the print queue. Accordingly, exclusive control isobtained in FIG. 6F in step S609 rather than step S617.

[0141] In this embodiment, since the recipient gains exclusive controlbefore a successful authentication process, a mechanism to releaseexclusive control in the event of an authentication failure is providedfor. Accordingly, if any of steps S610 to S615 (the authenticationprocess steps) result in an authentication (or authorization) failure,then in step S616 the recipient is notified of the failure and exclusivecontrol is automatically relinquished. Thus, in comparison to FIG. 6C,step S616 in FIG. 6F includes the additional process of releasing alldeferred print jobs.

[0142] If the recipient is successfully authenticated in steps S610 toS615, then in step S617, the printer notifies the print queue that therecipient has been authenticated. Therefore, in contrast to FIG. 6C, inFIG. 6F step S617 excludes the process of deferring the print jobs inthe print queue since this process was previously performed in stepS609.

[0143] The remaining process steps of FIG. 6F (steps S618 to S621) arethe same as those described above with regard to FIG. 6C and thereforethe description of these steps will not be repeated here.

[0144] As can readily be seen from the foregoing, exclusive control canbe obtained in conjunction with authentication, either before therecipient is successfully authenticated, with control beingautomatically relinquished in the event of an authentication failure, oronly after a successful authentication process has been performed.Although the foregoing focused on obtaining exclusive control inconjunction with authentication, as stated above, exclusive control canalso be obtained in the absence of authentication. This process will nowbe described in more detail.

[0145] Generally, the process of obtaining exclusive control in theabsence of authentication is similar to that described above with regardto FIGS. 6A to 6D (embodiment 1), and FIGS. 6A, 6B, 6D and 6F(embodiment 2). However, process steps involving authentication areomitted.

[0146]FIG. 16 is a flowchart of process steps for obtaining exclusivecontrol in the absence of authentication. In step S1609, the recipientperforms a process to gain exclusive control. As described above, anytype of process to gain exclusive control could be employed and theinvention is not limited to any particular type of process. Forinstance, the recipient could press a button on a control panel of theprinter to gain control, or he could enter a username. In the lattercase, an optional process could be performed to confirm whether therecipient's username is contained in a listing of authorized users. If amatch is found, the user would be permitted to gain control. If a matchis not found, then the user would be notified of a failure. Theseoptional steps are not depicted in FIG. 16, but would be performed afterstep S1609 and would be similar to steps S614, S615 and S616 of FIG. 6C.Assuming that the recipient performs a process to gain control that doesnot involve authorization (such as pressing a button), flow proceeds tostep S1610.

[0147] In step S1610, once the recipient performs the process to gainexclusive control, all print jobs pending in the print queue, as well asthose received by the print queue while the recipient maintains control,are deferred from being printed. Again, deferring the print jobs may beperformed by any process as described above.

[0148] In step S1611, the recipient performs a process to select a printjob to print. The process may be any of those described above withregard to FIGS. 17A to 17D. That is, the recipient may select a printjob pending in the print queue, or he may select a file from a remotestorage location over a network, including the Internet or an intranet.Once the recipient performs the process to select the file or print job,he submits the print job for printing by the printer (step S1612).

[0149] Steps S1613 to S1617 are the same as steps S626 to S630,respectively, of FIG. 6D. Therefore, if any of the print jobs are printby reference, the print data is retrieved from the storage location, andprinting resources utilized in printing the print job are tracked andcorrelated to the recipient. It should be noted that steps S1616 andS1617 can only be performed where the recipient has been identified.That is, in order for the printing resources to be correlated to therecipient, the recipient has to provide some identification information(e.g. username) to the printer in step S1609. Therefore, if therecipient merely presses a button, he is an anonymous recipient and anytracked resources could not be correlated to him. In this case, stepsS1616 and S1617 could be omitted.

[0150] Once the print job has been printed, a determination is madewhether the recipient has relinquished control (step S1618). Again,relinquishing control could be performed by any of the processesdescribed above and the invention is not limited to any particularprocess. If the recipient maintains control, flow returns to step S1611for the recipient to select another print job to print. In this regard,the printer waits for the recipient to select another print job in stepS1611 and remains busy for other print requests (i.e. the print jobspending in the queue remain deferred) until the recipient manuallyrelinquishes control. Of course, a timeout mechanism could also beemployed so that after a set length of inactivity by the user, theprinter would automatically relinquish control. Once control has beenrelinquished, then all of the deferred print jobs in the queue arereleased and the printer resumes normal printing operations (stepS1619).

[0151] The invention has been described with particular illustrativeembodiments. It is to be understood that the invention is not limited tothe above-described embodiments and that various changes andmodifications may be made by those of ordinary skill in the art withoutdeparting from the spirit and scope of the invention.

What is claimed is:
 1. A method for obtaining exclusive control of aprinting device by a recipient to print data intended for the recipient,the method comprising the steps of: authenticating the recipient;providing the recipient exclusive control of the printing device's printcapabilities after the recipient has been authenticated; and temporarilydeferring print data not intended for the recipient from being printedand printing print data intended for the recipient during a period inwhich the recipient has exclusive control of the printing device's printcapabilities.
 2. A method according to claim 1, wherein the print datanot intended for the recipient is deferred by the printing deviceproviding a busy indication.
 3. A method according to claim 1, whereinthe print data not intended for the recipient is deferred by beingtemporarily stored and a reference to a print data storage location issent to a print queue until the recipient relinquishes control of theprinting device's print capabilities.
 4. A method according to claim 1,wherein the print data not intended for the recipient is deferred bybeing rejected by the printing device.
 5. A method according to claim 1,wherein, once the recipient has exclusive control of the printingdevice's print capabilities, the recipient selects which print jobs toprint.
 6. A method according to claim 1, wherein the print data intendedfor the recipient is stored in a location other than in a print queueand a reference to the stored print data location is provided to theprint queue.
 7. A method according to claim 1, wherein the recipientgains exclusive control of the printing device's print capabilities bybeing authenticated utilizing a smart card device.
 8. A method accordingto claim 1, wherein the recipient gains exclusive control of theprinting device's print capabilities by being authenticated utilizing akeypad and entering a user code, a personal identification number, or apassword.
 9. A method according to claim 1, wherein the recipient gainsexclusive control of the printing device's print capabilities by beingauthenticated utilizing a biometric device.
 10. A method according toclaim 1, wherein said step of providing exclusive control of theprinting device's print capabilities includes verifying that therecipient is authorized to obtain exclusive control of the printingdevice's print capabilities.
 11. A method according to claim 1 furthercomprising the steps of: tracking printing device resources utilized inprinting data during the period in which the recipient has exclusivecontrol of the printing device's print capabilities; and correlating thetracked resources to the authenticated recipient.
 12. A method accordingto claim 11, wherein the tracked resources comprise at least one of anumber of printed pages, recording medium type, and amount of ink, toneror other medium utilized in printing the data.
 13. A method according toclaim 5, wherein, once the recipient has gained exclusive control of theprinting device's print capabilities, the recipient selects print datato print from a network.
 14. An apparatus for printing images,comprising: an authentication device that authenticates a recipient; aprint engine controlling printing operations of the apparatus; a printqueue temporarily storing and buffering print data submitted to theapparatus for printing; and control means for permitting a recipient tocontrol print capabilities of the apparatus after the recipient has beenauthenticated, wherein, after the recipient is authenticated, print datanot intended for the recipient is temporarily deferred from beingprinted and print data intended for the recipient is printed out duringa period in which the recipient has control over the apparatus' printcapabilities.
 15. An apparatus according to claim 14, wherein the printdata not intended for the recipient is deferred by the apparatusproviding a busy indication.
 16. An apparatus according to claim 14,wherein the print data not intended for the recipient is deferred bybeing temporarily stored and a reference to a print data storagelocation being sent to a print queue until the recipient relinquishescontrol of the apparatus' print capabilities.
 17. An apparatus accordingto claim 14, wherein the print data not intended for the recipient isdeferred by being rejected by the apparatus.
 18. An apparatus accordingto claim 14 further comprising a print job selection device, wherein,once the recipient has control of the apparatus' print capabilities, therecipient selects which print jobs to print.
 19. An apparatus accordingto claim 14, wherein the print data intended for the recipient is storedin a location other than in the print queue and a reference to thestored print data location is provided to the print queue.
 20. Anapparatus according to claim 14, wherein the recipient gains control ofthe apparatus' print capabilities by being authenticated utilizing asmart card device.
 21. An apparatus according to claim 14, wherein therecipient gains control of the apparatus' print capabilities by beingauthenticated utilizing a keypad and entering a user code, a personalidentification number, or a password.
 22. An apparatus according toclaim 14, wherein the recipient gains control of the apparatus' printcapabilities by being authenticated utilizing a biometric device.
 23. Anapparatus according to claim 14 further comprising: a tracking devicethat tracks printing resources utilized in printing data during theperiod in which the recipient has control over to the apparatus' printcapabilities; and a correlating device that correlates the trackedresources to the authenticated recipient.
 24. An apparatus according toclaim 23, wherein the tracked resources comprise at least one of anumber of printed pages, recording medium type, and amount of ink, toneror other medium utilized in printing the data.
 25. An apparatusaccording to claim 18, wherein the selection device provides aninterface with an network such that, once the recipient has gainedcontrol of the printing device's print capabilities, the recipientselects print data to print from the network.
 26. Computer-executableprocess steps for obtaining exclusive control of a printing device by arecipient to print data intended for the recipient, thecomputer-executable process steps comprising: authenticating therecipient; providing the recipient exclusive control of the printingdevice's print capabilities after the recipient has been authenticated;and temporarily deferring print data not intended for the recipient frombeing printed and printing print data intended for the recipient duringa period in which the recipient has exclusive control of the printingdevice's print capabilities.
 27. Computer-executable process stepsaccording to claim 26, wherein the print data not intended for therecipient is deferred by the printing device providing a busyindication.
 28. Computer-executable process steps according to claim 26,wherein the print data not intended for the recipient is deferred bybeing temporarily stored and a reference to a print data storagelocation being sent to a print queue until the recipient relinquishescontrol of the printing device's print capabilities. 29.Computer-executable process steps according to claim 26, wherein theprint data not intended for the recipient is deferred by being rejectedby the printing device.
 30. Computer-executable process steps accordingto claim 26, wherein, once the recipient has exclusive control of theprinting device's print capabilities, the recipient selects which printjobs to print.
 31. Computer-executable process steps according to claim26, wherein the print data intended for the recipient is stored in alocation other than in a print queue and a reference to the stored printdata location is provided to the print queue.
 32. Computer-executableprocess steps according to claim 26, wherein the recipient gainsexclusive control of the printing device's print capabilities by beingauthenticated utilizing a smart card device.
 33. Computer-executableprocess steps according to claim 26, wherein the recipient gainsexclusive control of the printing device's print capabilities by beingauthenticated utilizing a keypad and entering a user code, a personalidentification number or a password.
 34. Computer-executable processsteps according to claim 26, wherein the recipient gains exclusivecontrol of the printing device's print capabilities by beingauthenticated utilizing a biometric device.
 35. Computer-executableprocess steps according to claim 26, wherein said step of providingexclusive control of the printing device's print capabilities includesverifying that the recipient is authorized to obtain exclusive controlof the printing device's print capabilities.
 36. Computer-executableprocess steps according to claim 26 further comprising the steps of:tracking printing device resources utilized in printing data during theperiod in which the recipient has exclusive control of the printingdevice's print capabilities; and correlating the tracked resources tothe authenticated recipient.
 37. Computer-executable process stepsaccording to claim 36, wherein the tracked resources comprise at leastone of a number of printed pages, recording medium type, and amount ofink, toner or other medium utilized in printing the data. 38.Computer-executable process steps according to claim 30, wherein, oncethe recipient has gained exclusive control of the printing device'sprint capabilities, the recipient selects print data to print from anetwork.
 39. A method of printing images on a printing device,comprising the steps of: obtaining control over printing operations ofthe printing device; and performing a process to print out an image bythe printing device during a period of control over the printing device.40. A method according to claim 39, wherein the obtaining control stepcomprises deferring of all print jobs submitted to a print queue forprinting by the printing device.
 41. A method according to claim 39,wherein the obtaining control step comprises control over allcommunication interfaces of the printing device.
 42. A method accordingto claim 39, wherein the obtaining control step comprises control overnetwork access to the printing device.
 43. A method according to claim39, wherein control over the print operations comprises control overprint engine operations of the printing device.
 44. A method accordingto claim 39, wherein the performing step comprises accessing print dataover a network to be printed by the printing device.
 45. A methodaccording to claim 44, wherein the network is an Internet or anintranet.
 46. A method according to claim 40, wherein the performingstep comprises accessing at least one print job in the print queue. 47.A method according to claim 39, wherein the performing step comprisesperforming a copying operation.
 48. A method according to claim 39,wherein the performing step comprises performing a facsimile operation.49. A method according to claim 39, wherein the obtaining control stepcomprises authenticating a recipient.
 50. A method according to claim49, wherein the recipient obtains control before the recipient isauthenticated.
 51. A method according to claim 49, wherein the recipientobtains control after the recipient is authenticated.
 52. A methodaccording to claim 49, further comprising the steps of: trackingprinting device resources utilized during the performing step; andcorrelating the tracked resources to the authenticated recipient.
 53. Amethod according to claim 52, wherein the tracked resources comprise atleast one of a number of printed pages, recording medium type, andamount of ink, toner or other medium utilized in the performing step.54. A method of controlling printing operations of a printing device,comprising the steps of: obtaining control over the printing operationsof the printing device; and maintaining control over the printingoperations until control is manually relinquished by a recipient who hasobtained control.
 55. A method according to claim 54, wherein therecipient performs a process to access print data to print out an imageby the printing device while control is maintained over the printingdevice.
 56. A method according to claim 54, wherein the obtainingcontrol step comprises deferring of all print jobs submitted to a printqueue for printing by the printing device.
 57. A method according toclaim 54, wherein the obtaining control step comprises control over allcommunication interfaces of the printing device.
 58. A method accordingto claim 54, wherein the obtaining control step comprises control overnetwork access to the printing device.
 59. A method according to claim54, wherein control over the print operations comprises control overprint engine operations of the printing device.
 60. A method accordingto claim 55, wherein the performing step comprises accessing print dataover a network to be printed by the printing device.
 61. A methodaccording to claim 60, wherein the network is an Internet or anintranet.
 62. A method according to claim 56, wherein the performingstep comprises accessing at least one print job in the print queue ofthe printing device.
 63. A method according to claim 55, wherein theperforming step comprises performing a copying operation.
 64. A methodaccording to claim 55, wherein the performing step comprises performinga facsimile operation.
 65. A method according to claim 54, wherein theobtaining control step comprises authenticating a recipient.
 66. Amethod according to claim 65, wherein the recipient obtains controlbefore the recipient is authenticated.
 67. A method according to claim65, wherein the recipient obtains control after the recipient isauthenticated.
 68. A method according to claim 65, further comprisingthe steps of: the authenticated recipient performing a process to printout an image by the printing device while control is maintained over theprinting device; tracking printing device resources utilized during theperforming step; and correlating the tracked resources to theauthenticated recipient.
 69. A method according to claim 68, wherein thetracked resources comprise at least one of a number of printed pages,recording medium type, and amount of ink, toner or other medium utilizedin the performing step.
 70. A printing apparatus, comprising: a printengine controlling printing operations of the apparatus; a controldevice for permitting a recipient to obtain control over the printingoperations of the apparatus; and a print data access device forperforming a process to access print data to be printed by the printingapparatus.
 71. A printing apparatus according to claim 70, wherein thecontrol device defers printing of all print jobs submitted to a printqueue of the apparatus.
 72. A printing apparatus according to claim 70,wherein the control device controls all communication interfaces of theapparatus.
 73. A printing apparatus according to claim 70, wherein thecontrol device controls network access to the apparatus.
 74. A printingapparatus according to claim 70, wherein the control device controls theprint engine.
 75. A printing apparatus according to claim 70, whereinthe access device performs a process to access print data over anetwork.
 76. A printing apparatus according to claim 75, wherein thenetwork is an intranet or an Internet.
 77. A printing apparatusaccording to claim 71, wherein the access device performs a process toaccess at least one deferred print job in the print queue.
 78. Aprinting apparatus according to claim 70, wherein the access deviceperforms a copying process.
 79. A printing apparatus according to claim70, wherein the access device performs a facsimile process.
 80. Aprinting apparatus according to claim 70, wherein the control devicecomprises an authentication device for performing an authenticationprocess of the recipient.
 81. A printing apparatus according to claim80, wherein the control device permits the recipient to obtain controlbefore the recipient is authenticated.
 82. A printing apparatusaccording to claim 80, wherein the control device permits the recipientto obtain control after the recipient is authenticated.
 83. A printingapparatus according to claim 80, further comprising: a tracking devicethat tracks printing resources utilized in printing data during a periodin which the recipient has control of the printing operations; and acorrelating device that correlates the tracked resources to therecipient.
 84. A printing apparatus according to claim 83, wherein thetracked resources comprise at least one of a number of printed pages,recording medium type, and amount of ink, toner or other medium utilizedin printing the data.
 85. A printing apparatus, comprising: a printengine controlling printing operations of the apparatus; a controldevice for permitting a recipient to obtain control over the printingoperations of the apparatus and to maintain control until a time whenthe recipient relinquishes control; and a relinquishing device forrelinquishing control over the apparatus' printing operations.
 86. Aprinting apparatus according to claim 85, further comprising a printdata access device for performing a process to access print data to beprinted by the printing apparatus during a period in which the recipienthas control over the printing device.
 87. A printing apparatus accordingto claim 85, wherein the control device defers printing of all printjobs submitted to a print queue of the apparatus.
 88. A printingapparatus according to claim 85, wherein the control device controls allcommunication interfaces of the apparatus.
 89. A printing apparatusaccording to claim 85, wherein the control device controls networkaccess to the apparatus.
 90. A printing apparatus according to claim 85,wherein the control device controls the print engine.
 91. A printingapparatus according to claim 86, wherein the access device performs aprocess to access print data over a network.
 92. A printing apparatusaccording to claim 91, wherein the network is an intranet or anInternet.
 93. A printing apparatus according to claim 86, wherein theaccess device performs a process to access at least one deferred printjob in a print queue.
 94. A printing apparatus according to claim 86,wherein the access device performs a copying process.
 95. A printingapparatus according to claim 86, wherein the access device performs afacsimile process.
 96. A printing apparatus according to claim 85,wherein the control device comprises an authentication device forperforming an authentication process of the recipient.
 97. A printingapparatus according to claim 96, wherein the control device permits therecipient to obtain control before the recipient is authenticated.
 98. Aprinting apparatus according to claim 96, wherein the control devicepermits the recipient to obtain control after the recipient isauthenticated.
 99. A printing apparatus according to claim 96, furthercomprising: a tracking device that tracks printing resources utilized inprinting data during a period in which the recipient has control of theprinting operations; and a correlating device that correlates thetracked resources to the recipient.
 100. A printing apparatus accordingto claim 99, wherein the tracked resources comprise at least one of anumber of printed pages, recording medium type, and amount of ink, toneror other medium utilized in printing the data.
 101. Computer-executableprocess steps for printing images on a printing device, comprising thesteps of: obtaining control over printing operations of the printingdevice; and performing a process to print out an image by the printingdevice during a period of control over the printing device. 102.Computer-executable process steps according to claim 101, wherein theobtaining control step comprises deferring of all print jobs submittedto a print queue for printing by the printing device. 103.Computer-executable process steps according to claim 101, wherein theobtaining control step comprises control over all communicationinterfaces of the printing device.
 104. Computer-executable processsteps according to claim 101, wherein the obtaining control stepcomprises control over network access to the printing device. 105.Computer-executable process steps according to claim 101, whereincontrol over the print operations comprises control over print engineoperations of the printing device.
 106. Computer-executable processsteps according to claim 101, wherein the performing step comprisesaccessing print data over a network to be printed by the printingdevice.
 107. Computer-executable process steps according to claim 106,wherein the network is an Internet or an intranet. 108.Computer-executable process steps according to claim 102, wherein theperforming step comprises accessing at least one print job in the printqueue.
 109. Computer-executable process steps according to claim 101,wherein the performing step comprises performing a copying operation.110. Computer-executable process steps according to claim 101, whereinthe performing step comprises performing a facsimile operation. 111.Computer-executable process steps according to claim 101, wherein theobtaining control step comprises authenticating a recipient. 112.Computer-executable process steps according to claim 111, wherein therecipient obtains control before the recipient is authenticated. 113.Computer-executable process steps according to claim 111, wherein therecipient obtains control after the recipient is authenticated. 114.Computer-executable process steps according to claim 111, furthercomprising the steps of: tracking printing device resources utilizedduring the performing step; and correlating the tracked resources to therecipient.
 115. Computer-executable process steps according to claim114, wherein the tracked resources comprise at least one of a number ofprinted pages, recording medium type, and amount of ink, toner or othermedium utilized in the performing step.
 116. Computer-executable processsteps for controlling printing operations of a printing device,comprising the steps of: obtaining control over the printing operationsof the printing device; and maintaining control over the printingoperations until control is manually relinquished by a recipient who hasobtained control.
 117. Computer-executable process steps according toclaim 116, wherein the recipient performs a process to access print datato print out an image by the printing device while control is maintainedover the printing device.
 118. Computer-executable process stepsaccording to claim 116, wherein the obtaining control step comprisesdeferring of all print jobs submitted to a print queue for printing bythe printing device.
 119. Computer-executable process steps according toclaim 116, wherein the obtaining control step comprises control over allcommunication interfaces of the printing device. 120.Computer-executable process steps according to claim 116, wherein theobtaining control step comprises control over network access to theprinting device.
 121. Computer-executable process steps according toclaim 116, wherein control over the print operations comprises controlover print engine operations of the printing device. 122.Computer-executable process steps according to claim 117, wherein theperforming step comprises accessing print data over a network to beprinted by the printing device.
 123. Computer-executable process stepsaccording to claim 122, wherein the network is an Internet or anintranet.
 124. Computer-executable process steps according to claim 117,wherein the performing step comprises accessing at least one print jobin a print queue of the printing device.
 125. Computer-executableprocess steps according to claim 117, wherein the performing stepcomprises performing a copying operation.
 126. Computer-executableprocess steps according to claim 117, wherein the performing stepcomprises performing a facsimile operation.
 127. Computer-executableprocess steps according to claim 116, wherein the obtaining control stepcomprises authenticating a recipient.
 128. Computer-executable processsteps according to claim 127, wherein the recipient obtains controlbefore the recipient is authenticated.
 129. Computer-executable processsteps according to claim 127, wherein the recipient obtains controlafter the recipient is authenticated.
 130. Computer-executable processsteps according to claim 127, further comprising the steps of: therecipient performing a process to access print data to print out animage by the printing device while control is maintained over theprinting device; tracking printing device resources utilized during theperforming step; and correlating the tracked resources to the recipient.131. Computer-executable process steps according to claim 130, whereinthe tracked resources comprise at least one of a number of printedpages, recording medium type, and amount of ink, toner or other mediumutilized in the performing step.
 132. A method according to claim 13,wherein the network is an Internet or an intranet.
 133. An apparatusaccording to claim 25, wherein the network is an Internet or anintranet.
 134. Computer-executable process steps according to claim 38,wherein the network is an Internet or an intranet.
 135. A methodaccording to claim 1, wherein the recipient gains exclusive control ofthe printing device's print capabilities by being authenticatedutilizing a hardware token.
 136. An apparatus according to claim 14,wherein the recipient gains exclusive control of the printing device'sprint capabilities by being authenticated utilizing a hardware token.137. Computer-executable process steps according to claim 26, whereinthe recipient gains exclusive control of the printing device's printcapabilities by being authenticated utilizing a hardware token.